Table of Contents

Q203 - Default output directory in use
Description
Workaround
About JoomlaPack warnings

Q203 - Default output directory in use

Severity: Medium

Description

You got to this page because JoomlaPack detected that you are using the default backup output and / or temporary directories. This page will inform you on the potential pitfalls and security concerns of the default configuration, as well as how to secure your installation.

What's in the temporary / backup directory and why should I care?

The temporary directory files holds database dumps (.sql files), while the database dump step is running. They are deleted upon proceeding to the next step, if the process ends with catchable errors or when a new backup is started (if the previous backp attempt failed). If the backup fails with a PHP fatal error, these files remain in place. A malicious user with access to those files could steal proprietary / restricted information and/or security data by examining these SQL files.

On the other hand, the backup output directory contains backup archives. Some of them are complete archives, some of them could be incomplete (because the backup process failed at some point). Any backup file contains all of your site, including database contents and database connection information. A malicious user with access to those files could do everything and, what's more, produce an exact clone of your site to a server of his liking in order to explore new ways to attack your live server.

Why is using the default directories bad?

As said, a malicious user must have access to the temporary / backup files in order to exploit their contents. The default assigned to backup output and temporary directory is in a well known, browser accessible location. In fact, if your site's domain is www.example.com, the default directory can be accessed with http://www.example.com/administrator/components/com_joomlapack/backup. This opens a potential attack vector, unless you take action.

Workaround

Remember that JoomlaPack 1.3 and later versions use the temporary directory specified in Joomla!'s configuration.php (configuration key temp_dir). The security precautions described for the user-definable output directory also apply for the Joomla!'s temporary directory!

As a first line of defense, JoomlaPack includes an empty index.htm file in the default output directory. This is enough to keep script kiddies away, but any serious hacker will find this protection laughable at best. In order to avoid easily guessable filenames, JoomlaPack hashes the names of the temporary files. However, the backup archive name is left up to you and can sometimes be predicted, especially if you use the default naming convention.

By default JoomlaPack 1.2.b3 and later versions include an .htaccess for the default directory which disallows direct browser access. This has some shortcomings, as not all web servers support using .htaccess files (for example, IIS) or some hosts choose to allow .htaccess only for some specific folders or even none at all. In these cases, you are not protected at all and you should contact your host for restricting access to this directory.

Alternatively, you can use a directory above your server's root, effectively not allowing anyone access it from a web browser. The downside is that if you are restricted by open_basedir restrictions and / or PHP Safe Mode settings you might not be able to use it to backup your site. If you are obliged to use a folder under your web server's root you are strongly advised to disallow direct web access to this directory. If your server supports .htaccess files this can be easily accomplished by creating an .htaccess file on your backup output and temporary directories with the following contents:

deny from all

About JoomlaPack warnings

JoomlaPack detects potential issues which might negatively impact the backup process. Many of them are caused by specific PHP configurations. The cause of those issues is mostly or thoroughly known, but since it resides in the server configuration which JoomlaPack can not control we can't provide some "patch" or bug fix to solve them. We try to provide practical solutions or workarounds instead.

The severity of each of these warnings is displayed on the top of this help screen. There are three levels: low, medium and high. The "Low" level implies that the detected issue will most probably have no impact on you. "Medium" level warnings have a higher chance of causing problems, but the proposed workaround may be applied to alleviate its effects. "High" level warnings should be treated as errors; the detected issue will cause backup failure unless the proposed workaround is applied.

Remember, if all else fails, contact us on our support forum . We are here to help you. Please, before posting to the forum, try to follow the "workaround" procedure outlined above and tell us that you did try the proposed solution before asking us for support.